2371 Commits (818656524003c4501401709aecffb19c28ca588c)

Author	SHA1	Message	Date
Eric Leblond	2596d3bcdd	runmode: treat SCStrdup error.	14 years ago
Eric Leblond	beaa909eb8	Add "workers" runmode. ... Previous commits have considerabily empowered the "single" mode which could contain multiple threads. This behaviour was not a target for this runmode and the following patch remedies to the situation by introducing the "workers" mode where each thread do all the tasks from acquisition to logging. This runmode is currently implemented for af-packet and pf-ring.	14 years ago
Eric Leblond	788fa1e5a1	pfring: Fix typo in help.	14 years ago
Eric Leblond	730a86e6b8	pfring: fix warning ... When PF_RING is disable this function is unused and thus trigger a warning at compilation.	14 years ago
Eric Leblond	3f75b10f79	Suppress useless code. ... This code was making a warning for some time now. This patch kills it.	14 years ago
Eric Leblond	45d5c3ca59	runmode: introduce configuration dereferencing. ... A devide configuration can be used by multiple threads. It is thus necessary to wait that all threads stop using the configuration before freeing it. This patch introduces an atomic counter and a free function which has to be called by each thread when it will not use anymore the structure. If the configuration is not used anymore, it is freed by the free function.	14 years ago
Eric Leblond	3261b814db	Make SC_ATOMIC_[SUB|ADD] return result value ... This patch modifies the SC_ATOMIC_[SUB|ADD] to have them return the value of the result. This permit to write test based on return of the macro.	14 years ago
Eric Leblond	d3d99ffa13	Fix coding style and use SC* function. ... This patch fixes the coding style and uses Suricata function instead of plain lic version.	14 years ago
Eric Leblond	f998fda4dd	pfring: factorize iface and parser initialisation.	14 years ago
Eric Leblond	cc7b80437a	pfring: should not call free	14 years ago
Eric Leblond	93cf2b1690	pfring: add single mode.	14 years ago
Eric Leblond	77869a2df8	single runmode: add support for multiple capture threads	14 years ago
Eric Leblond	c75fffe92d	Improve help message ... Usage of command line has evolved with the introduction of long option. This patch updates the description of the related options.	14 years ago
Eric Leblond	dc075a74a2	pcap: add --pcap option ... This patch adds a --pcap option which can be used to select or an interface if an argument is provided or the interfaces defined in the configuration file.	14 years ago
Eric Leblond	b2c281920f	af-packet: should not call free	14 years ago
Eric Leblond	1aab2470db	af-packet: factorise single mode.	14 years ago
Eric Leblond	63d614162c	pcap: should not call free	14 years ago
Eric Leblond	491686c33e	pcap: factorise single mode.	14 years ago
Eric Leblond	abe99ee5f6	runmode: add factorisation function for single mode.	14 years ago
Eric Leblond	c3ba992652	pfring: restore precedence of command line options.	14 years ago
Eric Leblond	b2598f97e7	pcap: restore backward compatibility	14 years ago
Eric Leblond	21663acd3b	pcap: use good var name for live-interface	14 years ago
Eric Leblond	d3d8beb337	pcap: factorize runmode ... This patch factorizes auto and autofp runmodes for pcap.	14 years ago
Eric Leblond	d9d8286671	pfring: restore compatibility with v1.0 config ... Compatibility of pfring module with previous version was broken. This patch restores backward compatibility.	14 years ago
Eric Leblond	a64dcfeba2	pfring: use factorisation function ... This patch convert pfring to pktacqloop and use the new factorisation function. This also fixes commmand line parsing of pfring which is now able to work like af-packet: - 'suricata -c s.yaml --pfring' start suricata with all interfaces in conf - 'suricata -c s.yaml --pfring=eth2' start suricata on eth2	14 years ago
Eric Leblond	cbb36b5182	af-packet: remove unused function	14 years ago
Eric Leblond	75c875b1ac	af-packet: use factorisation function for Auto mode.	14 years ago
Eric Leblond	8bf0897b3c	Add factorisation function for runmode. ... This patch adds a function which will be used to factorise the Auto runmode between the different IDS mode.	14 years ago
Eric Leblond	d4d62f3099	http-uri: Remove useless function declaration.	14 years ago
Victor Julien	3401defbbb	tag: fixes and cleanups ... Major fixes for the tag subsystem: - Removed TimeGet call from tag packet runtime to safe a gettimeofday - Removed unused lock from data type - Fixed broken first packet skip logic - Fix broken reference counter logic - Fix memory leak on tag expiration - Cleaned up code	14 years ago
Anoop Saldanha	b7b58074de	fix ac unittest	14 years ago
Anoop Saldanha	d6f9e06bbb	update ac to behave the same way irrespective of the state count. Should improve performance. Also fix unittests to accomodate these changes	14 years ago
Anoop Saldanha	dcaef183e8	fix compiler warning for printf format	14 years ago
Victor Julien	bc5c9f4a52	Fix too many SMTP commands causing an integer overflow in the cmds_cnt variable, in turn causing an out of bounds memory write.	14 years ago
Victor Julien	9baa16af63	Convert flow memcap to u64. Bug #332.	14 years ago
Victor Julien	8208eacd79	Convert stream memcaps to u64. Bug #332.	14 years ago
Victor Julien	4c641f0deb	Fix compilation with profiling enabled.	14 years ago
Anoop Saldanha	3ec7b75194	fix timestamps for pseudo packets created during FFR - bug 337	14 years ago
Anoop Saldanha	9d94bb38d5	refactor flow timeout code. fix ipv6 address assignment for pseudo pkt.	14 years ago
Anoop Saldanha	246a4e9fff	for shutdown reassembly properly init the reassembly packet using PACKET_RECYCLE	14 years ago
Victor Julien	1a5931e878	pcap-log: fall back to sguil_base_dir option if 'dir' isn't set. Minor cleanups.	14 years ago
William Metcalf	3b3f5816bf	You spin me right round baby, right round like a rotating packet capture right round. Oh, also log file size counters are now uint64_t	14 years ago
Victor Julien	6bad2dbd79	Don't match on IP only rules that use ports if packet is not (proper) TCP, UDP or SCTP. Rules out frags matching as well.	14 years ago
Anoop Saldanha	63ed36a892	Replace all reallocs with SCReallocs	14 years ago
Anoop Saldanha	4307ea2348	Replace all frees with SCFrees	14 years ago
Anoop Saldanha	797b1a44c7	Replace all strdup with SCStrdup	14 years ago
Anoop Saldanha	13ea299ee0	Replace all mallocs with SCMallocs	14 years ago
Eric Leblond	de59c9f4b1	Add and use utility functions for checksum computing.	14 years ago
Eric Leblond	a85dc9b0e2	Add support for replace keyword. ... This patch adds support for the replace keyword. It is used with content to change selected part of the payload. The major point with this patch is that having a replace keyword made necessary to avoid all stream level check because we need to access to the could-be-modified packet payload. One of the main difficulty is to handle complex signature. If there is other content check, we must do the substitution when we're sure all match are valid. The patch adds an attribute to the thread context variable to be able to deal with recursivity of the match function. Replace is only activated in IPS mode and apply only to raw match.	14 years ago
Eric Leblond	0c34a1c5e7	rewrite constants and add flag for replace ... This patch make use of bit shift to rewrite some of the mask constants. It also delete an unused flag value and suppress the associated dead code. The numeric value of the flag is now used by the flag needed for replace code.	14 years ago
Victor Julien	77b7089f79	Fix stream-events not working. Stream events won't fit our 'detection only' schema. Fixes #321.	14 years ago
pilcrow	f5017e0d1a	Always try PCRE_NO_AUTO_CAPTURE first for signature regexes. ... Many, many pcre: signatures specify (...) when the more efficient (?:...) is all that is needed. This change attempts to force PCRE_NO_AUTO_CAPTURE on all unnamed capture groups, reverting to capturing when necessary, e.g., when \1 is referenced.	14 years ago
Victor Julien	60887131be	Fix minor address parsing compiler warning.	14 years ago
Anoop Saldanha	8028392e9a	fix mpm segv. Use sgh flags to check if the sgh has packet or stream mpm set or not	14 years ago
Anoop Saldanha	41d71a6d70	fix http http transaction id update. Update transactions as soon as we receive a callback on new request	14 years ago
pilcrow	ed69eeab14	Safer macro parenthesization and do/while use	14 years ago
Eric Leblond	bbd04fde30	NFQ: fix race condition at exit. ... A race condition was observed when leaving NFQ. This was caused by the queue handle being accessed after been nullified. This patch uses the handle mutex to protect the destruction and adds tests on nullity to avoid crashed.	14 years ago
Victor Julien	1ab6443e44	Fix compilation when profiling is enabled.	14 years ago
Anoop Saldanha	b6ba944e6d	Rearrange flow manager functions into flow-manager.[ch]. Some other minor changes/updates	14 years ago
Anoop Saldanha	7c729d2d53	some more code cleanup + comments added	14 years ago
Anoop Saldanha	d14fdb1156	Remove the unnecessary unittest runmode check to get the test working. Modify tests to get it working around this	14 years ago
Anoop Saldanha	16884a0dea	refix failing unittest	14 years ago
Anoop Saldanha	552e72e35e	fix failing unittest	14 years ago
Anoop Saldanha	0957c0f8a4	shutdown timeout reassembly shouldn't check timeout flag set or not on flow	14 years ago
Anoop Saldanha	3f1c4efceb	Add new flags var to tm module. TMs can now set flags to identify special properties. Also use these to identify receive TMs	14 years ago
Anoop Saldanha	54f6e4ff4d	Merge thread kill functions. Merge slot's tm_id with the one used by packet profiling. Remove some junk unused code from ms sync pts. Timeout setup cleanup as well. packet q dbg_maxlen now u32 var.	14 years ago
Anoop Saldanha	e335bdbfbc	Code cleanup. All code to kill flow manager thread under one function now.	14 years ago
Anoop Saldanha	99a496e852	Indentation fixes	14 years ago
Anoop Saldanha	e68ca2f32f	Rewrite forced reassembly v2 using while loop instead of goto	14 years ago
Anoop Saldanha	6cc179fad8	flow mgr code doesn't have to bother on immediately exiting on seeing a suricata_ctl flag set	14 years ago
Anoop Saldanha	b09c9751aa	Now flow hash section can force reassemble flows as well	14 years ago
Anoop Saldanha	42493ee6b7	rename pseudo packet creation function. Shift the check for forced reassembly necessity on a session/direction to an inline function in the stream api	14 years ago
Anoop Saldanha	6c95526423	Introduce a new wrapper macro that wait loops till the flag(s) in question have been set	14 years ago
Anoop Saldanha	a7acf9ea8f	Remove all code introduced earlier concerned with ms sync points	14 years ago
Anoop Saldanha	b0a588beeb	Introduce another solution to solve stream timeout shutdown issue using thread flags. No more MSSyncPts	14 years ago
Anoop Saldanha	aef957c6eb	cleanup flow code and pseudo packet creation function	14 years ago
Anoop Saldanha	f2bcf9ea2c	modify post_pq packet handling. ... - Lock the q just once, once we have detected the presence of packet(s) in the queue. Unlock it when we consume all packets from the q.	14 years ago
Anoop Saldanha	b4887943fb	packet queue len member is now 32 bit unsigned from the previous 16 bit unsigned. Should take care of the overflow for now	14 years ago
Anoop Saldanha	9256c7bf0a	always keep queue locked till we exit flowprune. Should prevent potential threading issues	14 years ago
Anoop Saldanha	d4ba869a35	fix - we need to set direction flags for reassembly pseudo packet. Also reset local flags for every flow that is force reassembled in ForQ	14 years ago
Anoop Saldanha	4ef3679b13	Remove the macro for pktacqloop which is now replaced by an inline function	14 years ago
Anoop Saldanha	edebdee1e5	update flow pruning - v6	14 years ago
Anoop Saldanha	99207c718d	Avoid possiblity of potential engine idling from consumption of all packetpool packets - v1 ... - Now forced reassembly uses only malloced packets.	14 years ago
Anoop Saldanha	7d3e501f57	shutdown stream reassembly now avoids looking at flows that have already been processed by flow mgr reassembly	14 years ago
Anoop Saldanha	a559bfc165	signal the post pq if possible, whenever pseudo packets are injected into engine flow. Also carry out post pq processing irrespective of packet retrieval from the flow.	14 years ago
Anoop Saldanha	fd9bacb02d	fix usage of htons to htonl in creation of pseudo packet	14 years ago
Anoop Saldanha	56fba8e275	move flow incr cnt while we actually create the pseudo packet in forced reassembly	14 years ago
Anoop Saldanha	51d2b64902	update flow pruning - v5	14 years ago
Anoop Saldanha	c30dbff63d	update flow pruning - v4	14 years ago
Anoop Saldanha	3b0142fa46	update flow pruning - v3	14 years ago
Anoop Saldanha	6dcb68abb0	update flow pruning - v2	14 years ago
Anoop Saldanha	f197b32a55	update flow pruning - v1	14 years ago
Anoop Saldanha	272c2433ec	Cleanup flow.c before further changes	14 years ago
Anoop Saldanha	8363533a02	support for forced stream reassembly for to be pruned flows	14 years ago
Anoop Saldanha	727a950e39	Move time elapsed right after we finish all packet processing	14 years ago
Anoop Saldanha	762ac0fe31	update conditional in shutdown forced reassembly to check for flows that required flow reassemly	14 years ago
Anoop Saldanha	15359dc47e	Slot structure now holds the TV it belongs to	14 years ago
Anoop Saldanha	9552e6f696	Shutdown flow timeout reassembly now supports ipv6	14 years ago
Anoop Saldanha	54f8d56f48	Packet inspection keywords modified to not inspect pseudo packet	14 years ago
Anoop Saldanha	c365bafbf6	We now inspect timed out streams + streams not processed as yet, at engine shutdown	14 years ago
Anoop Saldanha	56432cee16	Single thread kill also checks if inq is cleared before shutting down	14 years ago
Anoop Saldanha	8fa923c5ac	- All threads also check to see if their inq is cleared before they shutdown.	14 years ago
Anoop Saldanha	a844eecb0e	- Updated all runmodes to use synchronization points, right before each thread(slot function) tries to de-init the thread. - Main thread now first disables receive thread(s) before it kills receive and rest of the threads.	14 years ago
Anoop Saldanha	e567c2d002	Introduce master-slave synchronization support for ThreadVars	14 years ago
Anoop Saldanha	94c5ecb069	introduce inline function version of TmThreadsSlotProcessPkt macro. Retain the macro as well	14 years ago
Anoop Saldanha	fd6faac196	update TmThreadsSlotProcessPkt with better error handling + post pq processing	14 years ago
Anoop Saldanha	3fb65f5ec2	fix local var usage for slot in tm-threads.c	14 years ago
Anoop Saldanha	acbcee69ff	support post pq packet processing in var slot	14 years ago
Victor Julien	cc4e89fbe1	Profiling: convert all packet profile counters/variables to u64. Improve output for larger numbers.	14 years ago
Eileen Donlon	e8c51e09e8	fixed bug 291 corrected reference to reference-config-file	14 years ago
Eileen Donlon	89599d3b9b	fixed bug 288; corrected config boolean parsing problems	14 years ago
Eric Leblond	de1d002ea6	Return OK when leaving cleanly.	14 years ago
Eric Leblond	2631e5f14f	pcap: get rid of old API.	14 years ago
Eric Leblond	6f975d3248	pcap: add "autofp" runmode ... This patch adds "autofp" runmode. This runmode supports multiple devices and uses the new CPU affinity system.	14 years ago
Eric Leblond	effa295489	pcap: add "single" runmode ... This patch adds support for the "single" mode to the pcap live mode.	14 years ago
Victor Julien	e13181496c	ip-only: added support for matching on ports.	14 years ago
Victor Julien	3d396e8b1e	Update PCRE JIT code to support official JIT implementation in pcre-8.20-RC1.	14 years ago
Victor Julien	751a77a9be	Make sure stream/engine-event signatures are recognized as such.	14 years ago
Victor Julien	c590bba4a4	Undo tunnel reference counting using atomic operations. Revert to mutex based code.	14 years ago
Victor Julien	63f834d9a7	Add profiling to various HTTP buffer MPM calls.	14 years ago
Victor Julien	2675879ff1	Engine and stream events only rules can are deonly compat as well.	14 years ago
Eric Leblond	bd7ac3eaa6	PrintInet: fix compilation on FreeBSD	14 years ago
Anoop Saldanha	3801e00426	fix compliation warnings from runmode-af-packet.c	14 years ago
Victor Julien	baddfcaa1a	Extend packet profiling to other thread 'slot' functions.	14 years ago
Victor Julien	3693a7a9ee	Profiling: add accounting for several detection phases.	14 years ago
Victor Julien	e8e392fb1f	Profiling: add per packet accounting of how much ticks are spend in protocol detection.	14 years ago
Eric Leblond	7425bf5ca6	Rename some decode event structure and macro. ... This patch renames DECODER_SET_EVENT, DECODER_ISSET_EVENT and some other structures to ENGINE equivalent to take into account the fact the event list is now related to all engines and not only to decoder.	14 years ago
Eric Leblond	de65b11c42	decode signature optimisation requires different treatment ... Decode signature are using the fact that no proto is set on packet to increase the matching speed. This is not the case of stream and other engine events. Thus a difference needs to be made.	14 years ago
Eric Leblond	3f153fb0da	Add 'stream-event' keyword. ... This patch adds an alias to the 'engine-event' keyword. It is now possible to access to the stream events via the 'stream-event' keyword. A simple transformation is done: stream-event:reassembly_segment_before_base_seq is a shortcut for: engine-event:stream.reassembly_segment_before_base_seq	14 years ago
Eric Leblond	eb0d4e4d8b	Add stream events support to 'engine-event' keyword ... This patch adds the list of stream events (with associated keywords) to the list of events that can be treated by 'engine-event'.	14 years ago
Eric Leblond	e3a6d8955e	Introduce engine-event keyword ... This patch renames the 'decode-event' keyword to 'engine-event' and keep it for backword compatibility of rulesets. All *DecodeEvent* references in the code are replaced by EngineEvent version.	14 years ago
Eric Leblond	2ac8755382	Rename detect-decode-event to detect-engine-event ... This patch does a simple renaming of detect-decode-event file to the more global detect-engine-event name.	14 years ago
Victor Julien	21f387d2c7	profiling: fix stream ticks miscalculation on stream end pseudo packets.	14 years ago
Eric Leblond	ff6365dd33	af-packet: switch to pcktacqloop API. ... This patch gets rid of the old API and brings some optimisation by reordering structure and optimisinf an error test.	14 years ago
Eric Leblond	834c91eece	af-packet: add AFP to per packet performance system.	14 years ago
Eric Leblond	fb4be6199f	af-packet: change option name ... This patch changes the option name. af-packet long option is now used instead of -a to mimic pfring behaviour. This patch improves the standard parsing of the command line. Running suricata -c suricata.yaml --af-packet will start a suricata running in AF_PACKET mode listening on all interfaces defined in the suricata.yaml configuration file. The traditionnal syntax: suricata -c suricata.yaml --af-packet=ppp0 will start a suricata listening on ppp0 only.	14 years ago
Eric Leblond	e253da092c	device: Add function to build interface list from config ... This patch adds a new function which build the list of interfaces to use by parsing the configuration file. This is using the new format and thus only af-packet can benefit of this feature.	14 years ago
Eric Leblond	df7dbe36b6	af-packet: Add option to disable promiscuous mode ... This patch adds an option to suricata.yaml to be able to disable the switch of the interface into promiscuous mode.	14 years ago
Eric Leblond	fbca1a4e6b	af-packet: multi interface support ... This patch adds multi interface support to AF_PACKET. A structure is used at thread creation to give all needed information to the input module. Parsing of the options is done in runmode preparation through a dedicated function which return the configuration in a structure usable by thread creation.	14 years ago
Eric Leblond	dc667af1a1	conf: Introduce new function to input configuration. ... The input modules are needing a per interface configuration. This implies some new operations to be able to parse easily te configuration. The syntax of the configuration file is for example: af-packet: - interface: eth0 threads: 2 - interface: eth1 threads: 3 We need a way to express get a configuration variable for interface[eth0]. This is by using ConfNodeLookupKeyValue() to get the matching node. And after that value can be fetch by using ConfGetChildValue*() functions.	14 years ago
Eric Leblond	e80b30c082	af-packet: finalize code ... This patch handles the end of AF_PACKET socket support work. It provides conditional compilation, autofp and single runmode. It also adds a 'defrag' option which is used to activate defrag support in kernel to avoid rx_hash computation in flow mode to fail due to fragmentation. This patch contains some fixes by Anoop Saldanha, and incorporate change following review by Anoop Saldanha and Victor Julien. AF_PACKET support is only build if the --enable-af-packet flag is given to the configure command line. Detection of code availability is also done: a check of the existence of AF_PACKET in standard header is done. It seems this variable is Linux specific and it should be enough to avoid compilation of AF_PACKET support on other OSes. Compilation does not depend on up-to-date headers on the system. If none are present, wemake our own declaration of FANOUT variables. This will permit compilation of the feature for system where only the kernel has been updated to a version superior to 3.1.	14 years ago
Eric Leblond	871b21892a	factorize pcap live device function ... They are not specific to pcap and could thus be used in other module.	14 years ago
Eric Leblond	c45d898572	af-packet: basic support for AF_PACKET socket ... This patch provides basic support for AF_PACKET socket. It is completed by a subsequent patches prodiding extended features and bugfixes.	14 years ago
Anoop Saldanha	58b595cc21	fastlog print updates for ipv6. combine the io write	14 years ago
Anoop Saldanha	e8f9557664	fastlog print updates. combine the io write	14 years ago
Victor Julien	fca541f40e	Add per app layer parser profiling ... Per packet per app layer parser profiling. Example summary output: Per App layer parser stats: App Layer IP ver Proto cnt min max avg -------------------- ------ ----- ------ ------ ---------- ------- ALPROTO_HTTP IPv4 6 163394 126 38560320 42814 ALPROTO_FTP IPv4 6 644 117 26100 2566 ALPROTO_TLS IPv4 6 670 117 7137 799 ALPROTO_SMB IPv4 6 114794 126 225270 957 ALPROTO_DCERPC IPv4 6 5207 126 25596 1266 Also added to the csv out. In the csv out there is a new column "stream (no app)" that removes the app layer parsers from the stream tracking. So raw stream engine performance becomes visible.	14 years ago
Victor Julien	0cc9f39200	Move TlsConfig structure out of app-layer-protos.h and rename it to SslConfig.	14 years ago
Victor Julien	820b0ded82	Add per packet profiling. ... Per packet profiling uses tick based accounting. It has 2 outputs, a summary and a csv file that contains per packet stats. Stats per packet include: 1) total ticks spent 2) ticks spent per individual thread module 3) "threading overhead" which is simply calculated by subtracting (2) of (1). A number of changes were made to integrate the new code in a clean way: a number of generic enums are now placed in tm-threads-common.h so we can include them from any part of the engine. Code depends on --enable-profiling just like the rule profiling code. New yaml parameters: profiling: # packet profiling packets: # Profiling can be disabled here, but it will still have a # performance impact if compiled in. enabled: yes filename: packet_stats.log append: yes # per packet csv output csv: # Output can be disabled here, but it will still have a # performance impact if compiled in. enabled: no filename: packet_stats.csv Example output of summary stats: IP ver Proto cnt min max avg ------ ----- ------ ------ ---------- ------- IPv4 6 19436 11448 5404365 32993 IPv4 256 4 11511 49968 30575 Per Thread module stats: Thread Module IP ver Proto cnt min max avg ------------------------ ------ ----- ------ ------ ---------- ------- TMM_DECODEPCAPFILE IPv4 6 19434 1242 47889 1770 TMM_DETECT IPv4 6 19436 1107 137241 1504 TMM_ALERTFASTLOG IPv4 6 19436 90 1323 155 TMM_ALERTUNIFIED2ALERT IPv4 6 19436 108 1359 138 TMM_ALERTDEBUGLOG IPv4 6 19436 90 1134 154 TMM_LOGHTTPLOG IPv4 6 19436 414 5392089 7944 TMM_STREAMTCP IPv4 6 19434 828 1299159 19438 The proto 256 is a counter for handling of pseudo/tunnel packets. Example output of csv: pcap_cnt,ipver,ipproto,total,TMM_DECODENFQ,TMM_VERDICTNFQ,TMM_RECEIVENFQ,TMM_RECEIVEPCAP,TMM_RECEIVEPCAPFILE,TMM_DECODEPCAP,TMM_DECODEPCAPFILE,TMM_RECEIVEPFRING,TMM_DECODEPFRING,TMM_DETECT,TMM_ALERTFASTLOG,TMM_ALERTFASTLOG4,TMM_ALERTFASTLOG6,TMM_ALERTUNIFIEDLOG,TMM_ALERTUNIFIEDALERT,TMM_ALERTUNIFIED2ALERT,TMM_ALERTPRELUDE,TMM_ALERTDEBUGLOG,TMM_ALERTSYSLOG,TMM_LOGDROPLOG,TMM_ALERTSYSLOG4,TMM_ALERTSYSLOG6,TMM_RESPONDREJECT,TMM_LOGHTTPLOG,TMM_LOGHTTPLOG4,TMM_LOGHTTPLOG6,TMM_PCAPLOG,TMM_STREAMTCP,TMM_DECODEIPFW,TMM_VERDICTIPFW,TMM_RECEIVEIPFW,TMM_RECEIVEERFFILE,TMM_DECODEERFFILE,TMM_RECEIVEERFDAG,TMM_DECODEERFDAG,threading 1,4,6,172008,0,0,0,0,0,0,47889,0,0,48582,1323,0,0,0,0,1359,0,1134,0,0,0,0,0,8028,0,0,0,49356,0,0,0,0,0,0,0,14337 First line of the file contains labels. 2 example gnuplot scripts added to plot the data.	14 years ago
Victor Julien	1bd1a62526	Rename profile macro's and variables to reflect that they are for rule profiling.	14 years ago
Eric Leblond	88559901d4	pcap-file: Allocated packet must be free if there's error	14 years ago